{"id":"GHSA-v8gq-5grq-9728","aliases":["RUSTSEC-2020-0165"],"url":"https://o3.security/vulnerability/GHSA-v8gq-5grq-9728","summary":"mozjpeg DecompressScanlines::read_scanlines is Unsound","details":"This issue and vector is similar to [RUSTSEC-2020-0029] of `rgb` crate which `mozjpeg` depends on.\n\nAffected versions of `mozjpeg` crate allow creating instances of any type `T` from bytes,\nand do not correctly constrain `T` to the types for which it is safe to do so.\n\nExamples of safety violation possible for a type `T`:\n\n* `T` contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address.\n* `T` requires a safety and/or validity invariant for its construction that may be violated.\n\nThe issue was fixed in 0.8.19 by using safer types and involving `rgb` dependency bump.\n\n[RUSTSEC-2020-0029]: https://rustsec.org/advisories/RUSTSEC-2020-0029.html\n","published":"2022-09-16T21:03:43Z","modified":"2023-11-08T04:23:09.541378Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"mozjpeg","fixedVersion":"0.8.19"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ImageOptim/mozjpeg-rust/issues/10"},{"type":"PACKAGE","url":"https://github.com/ImageOptim/mozjpeg-rust"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2020-0165.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2023-11-08T04:23:09.541378Z"}}